[steven-mi]

Fixes Dependabot alert #39 (critical) — certifi bundled emSign root CAs whose intermediate CA keys were compromised.

certifi is a transitive dependency (via requests); adds an explicit certifi = ">=2026.10.19" floor in pyproject.toml, same pattern as the existing oauthlib/urllib3/PyJWT pins. The repo has no lockfile, so CI resolves the patched version directly.

Jira: AIP-1609

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central TS config (base), Organization UI (inherited); Enforced overrides: Organization
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2963e39f-9f30-49c5-bd5c-2bed6acbf5f2

Commits

Reviewing files that changed from the base of the PR and between d4f0e77 and 3f6cdb6.

Files selected for processing: 1

• pyproject.toml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

Recent review details

Additional comments: 1

pyproject.toml: 1

22-23: LGTM!

📝 Summary

Risk Score: Low - Auto-merge Candidate

The dependency configuration now requires certifi >=2026.10.19. This raises the minimum version of the transitive requests dependency to address the distrusted emSign root CAs advisory. No application logic changes. The supplied evidence does not establish test results or production outage risk.

The project configuration now requires certifi version 2026.10.19 or later. A comment identifies certifi as a transitive dependency of requests and notes the distrusted emSign root CAs.

Suggested labels: coderabbit-risk:low

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · up to 3f6cd

The requested certifi security minimum is correctly applied with no identified merge-blocking issue.

- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}